p0f vs termshark

p0f has no write-up on Specifiction yet; its figures are above.

termshark is a terminal interface for tshark, inspired by Wireshark, for inspecting packet captures and network traffic. It can read pcap files or sniff live interfaces when tshark is permitted, including on a remote machine where a capture need not be copied to a desktop. Users can apply Wireshark display filters, group conversations by protocol, and reassemble TCP and UDP streams. Packet search covers packet lists, structures and bytes, using text, regular expressions, hexadecimal input or display filters. The guide also describes importing a Wireshark column set when the configuration can be found, and transferring the current capture with Magic Wormhole. The project lists Linux, macOS, BSD variants, Android through Termux and Windows. It is free and MIT-licensed, and the project says its Go implementation builds as one executable on each platform. Packet analysis requires tshark 1.10.2 or higher in the user's PATH. The project notes that some tshark features are not yet exposed by termshark; the latest listed release is v2.4.0, dated July 11, 2022.